# Check an order

> Send every order to Antiro before you accept it, and get a decision back.

This is one page of the Antiro docs (https://docs.antiro.io/api/assessments). Every page in one file: https://docs.antiro.io/llms-full.txt

`POST https://api.antiro.io/v1/assessments`

## Body parameters

Every parameter is optional, but the decision is only as accurate as what you send.

- `session_token` (string, Recommended): The order reference: the form’s `antiro_token` field, the `_atr_st` cookie, or `Antiro.token()`.
- `order_id` (string, Recommended): Your order number. Sending the same value again returns the first decision and creates nothing new.
- `phone` (string, Recommended): The customer’s phone number, as typed.
- `ip` (string, Recommended): The shopper’s real IP address, not your server’s. Behind Cloudflare, read it from the `CF-Connecting-IP` header.
- `name` (string): The customer’s name.
- `address` (string): The delivery address.
- `wilaya` (string): The wilaya.
- `commune` (string): The commune.
- `total` (number): The order amount. A value that is not a number is ignored.
- `sdk_expect` (forms | collect): Says how this order’s page runs the script. See [Tell Antiro which mode you use](https://docs.antiro.io/sdk/modes#tell-antiro-which-mode-you-use). Send it only for orders placed on pages that run the script.
- `sdk_required` (boolean): Strict mode for this order, read only together with `sdk_expect`. With `true`, an order that carries no reference at all is refused instead of held for review. See [Strict mode](https://docs.antiro.io/sdk/modes#strict-mode).
- `client_headers` (object): Headers of the shopper’s own order request, under lower-case names: `user-agent`, `accept-language`, `sec-ch-ua`, `sec-ch-ua-mobile`, `sec-ch-ua-platform`, `sec-fetch-site`, `sec-fetch-mode`, `sec-fetch-dest`, `x-requested-with`, `origin` and `referer`. Other names are dropped.

## Example request

**POST /v1/assessments · cURL**

```bash
curl https://api.antiro.io/v1/assessments \
  -H "X-API-Key: $ANTIRO_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_token": "<antiro_token>",
    "sdk_expect": "forms",
    "order_id": "1042",
    "phone": "0661234567",
    "name": "Yacine Benali",
    "address": "Cite 200 logements, Bab Ezzouar",
    "wilaya": "Alger",
    "total": 4900,
    "ip": "105.101.22.7"
  }'
```

**POST /v1/assessments · Node.js**

```js
const API = 'https://api.antiro.io/v1/assessments';

const res = await fetch(API, {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ANTIRO_SECRET_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    session_token: req.body.antiro_token,
    sdk_expect: 'forms',
    order_id: order.id,
    phone: order.phone,
    name: order.name,
    address: order.address,
    wilaya: order.wilaya,
    total: order.total,
    ip: req.ip,
  }),
  signal: AbortSignal.timeout(6000),
});

const { action, reasons } = await res.json();
```

**POST /v1/assessments · PHP**

```php
$token = $_POST['antiro_token']
    ?? $_COOKIE['_atr_st'] ?? '';

$ch = curl_init('https://api.antiro.io/v1/assessments');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 6,
    CURLOPT_HTTPHEADER => [
        'X-API-Key: ' . getenv('ANTIRO_SECRET_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'session_token' => $token,
        'sdk_expect' => 'forms',
        'order_id' => $order['id'],
        'phone' => $order['phone'],
        'name' => $order['name'],
        'address' => $order['address'],
        'wilaya' => $order['wilaya'],
        'total' => $order['total'],
        'ip' => $_SERVER['REMOTE_ADDR'],
    ]),
]);

$answer = json_decode(curl_exec($ch), true);
$action = $answer['action'] ?? null;
```

## Response

A successful check answers `201 Created`.

- `action` (string): What to do with the order: `allow`, `review` or `block`. See [Act on the decision](https://docs.antiro.io/api/decisions).
- `recommended` (string): Antiro’s own decision. It differs from `action` in [Monitor mode](https://docs.antiro.io/api/decisions#protection-modes).
- `probability` (number): The probability that the order is fake, from 0 to 1.
- `confidence` (number): How much Antiro trusts that probability, from 0 to 1.
- `reasons` (array): The reasons for the decision, strongest first. See [Reasons](https://docs.antiro.io/api/assessments#reasons).
- `id` (string): The id of this check. Use it as `assessment_id` when you [report an outcome](https://docs.antiro.io/api/outcomes), or to [read the check later](https://docs.antiro.io/api/assessments#read-a-check-later).
- `order_id` (string): Antiro’s id for the order. It is not your order number.

**201 Created**

```json
{
  "id": "dfe0a5d8-9284-48d6-a2cd-ec49f2957f3b",
  "order_id": "94074eb2-6c23-42e0-92f9-9f865cf88452",
  "action": "review",
  "recommended": "review",
  "probability": 0.94,
  "confidence": 0.65,
  "reasons": [
    {
      "code": "contact.phone:pattern",
      "group": "contact",
      "weight": 1.36,
      "label": {
        "en": "Fake-looking phone number",
        "ar": "رقم هاتف يبدو وهمياً",
        "fr": "Numéro d’apparence factice"
      }
    },
    {
      "code": "contact.address:weak",
      "group": "contact",
      "weight": 0.51,
      "label": {
        "en": "Incomplete delivery address",
        "ar": "عنوان توصيل ناقص",
        "fr": "Adresse de livraison incomplète"
      }
    }
  ]
}
```

### Reasons

Each item of `reasons` has these fields:

- `code` (string): A short code for the reason.
- `group` (string): The family the reason belongs to.
- `weight` (number): How much the reason counted.
- `label` (object): A ready-made text for your team, in `en`, `ar` and `fr`.

## Read a check later

`GET https://api.antiro.io/v1/assessments/:id`

Returns a past check by the `id` of its answer. The answer has the fields above, plus these three:

- `kind` (string): What was checked. For an order check, `order`.
- `verdict` (string): The verdict you reported with [`POST /v1/outcomes`](https://docs.antiro.io/api/outcomes), or `null`.
- `created_at` (string): When the check ran.

**GET /v1/assessments/:id**

```bash
curl https://api.antiro.io/v1/assessments/<id> \
  -H "X-API-Key: $ANTIRO_SECRET_KEY"
```

**200 OK**

```json
{
  "id": "dfe0a5d8-9284-48d6-a2cd-ec49f2957f3b",
  "order_id": "94074eb2-6c23-42e0-92f9-9f865cf88452",
  "kind": "order",
  "action": "review",
  "recommended": "review",
  "probability": 0.94,
  "confidence": 0.65,
  "reasons": [],
  "verdict": "fake",
  "created_at": "2026-10-30T10:03:06.493Z"
}
```